Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752147AbeADFti (ORCPT + 1 other); Thu, 4 Jan 2018 00:49:38 -0500 Received: from mga14.intel.com ([192.55.52.115]:1978 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751054AbeADFtf (ORCPT ); Thu, 4 Jan 2018 00:49:35 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,505,1508828400"; d="scan'208";a="7916877" Subject: Re: [RFC PATCH] asm/generic: introduce if_nospec and nospec_barrier To: Dan Williams , Al Viro References: <20180103223827.39601-1-mark.rutland@arm.com> <151502463248.33513.5960736946233335087.stgit@dwillia2-desk3.amr.corp.intel.com> <20180104010754.22ca6a74@alans-desktop> <1515035438.20588.4.camel@intel.com> <20180104044424.GC21978@ZenIV.linux.org.uk> Cc: "torvalds@linux-foundation.org" , "linux-kernel@vger.kernel.org" , "peterz@infradead.org" , "tglx@linutronix.de" , "alan@linux.intel.com" , "Reshetova, Elena" , "mark.rutland@arm.com" , "gnomes@lxorguk.ukuu.org.uk" , "gregkh@linuxfoundation.org" , "jikos@kernel.org" , "linux-arch@vger.kernel.org" From: Dave Hansen Message-ID: Date: Wed, 3 Jan 2018 21:49:33 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 01/03/2018 09:44 PM, Dan Williams wrote: > No, the concern is that an fd value >= fdt->max_fds may cause the cpu > to read arbitrary memory addresses relative to files->fdt and > userspace can observe that it got loaded. Yep, it potentially tells you someting about memory after fdt->fd[]. For instance, you might be able to observe if some random bit of memory after the actual fd[] array had 'mask' set because the CPU is running this code with a 'file' that actually fails the "fd < fdt->max_fds" check: file = __fcheck_files(files, fd); if (!file || unlikely(file->f_mode & mask)) return 0; return (unsigned long)file;